On 3/7/07, Carlos Macedo Gomes wrote: > > Hi Eric, > > I believe Hex Workshop [1] (a Windows based tool) will do what you > want. It can handle file and sector circular bitwise shifts in either > direction and has options for taking into account the data's > Endian-ness. I'm not sure about doing an entire partition but since > you can open an entire drive w/ the tool you may be able to do the > shift. If you have the ability to write the partition to an image > file (e.g., using something akin to DriveSpy's [2] SavePart command) > then you can bitshift the image file and possibly achieve your > objective. > > Let me know if this helps or, if not, what alternatives you find as > I'd be interested in the results. I do some digital forensics support > at work (for a local Fortune 50) and teach cybercrime/digitalforensics > at night. > > thanks, > C.G. > > [1] http://www.bpsoft.com/ > [2] http://www.digitalintelligence.com/software/disoftware.php > > On 3/7/07, evb had written: > > > > Sorry for the OT post, but all my other avenues have failed. Thus I am > > seeking out the advice of the technorati on this list. > > > > I would like a tool(Linux or Windows) that would bitshift all bits > within a > > defined scope (file/sector/partition/etc). Specifically, I would like a > > tool that will perform the following operation at the file/sector level: > > http://en.wikipedia.org/wiki/Circular_shift > > > > I already have a tool that will shift bits at the sector level, but only > if > > the data is on a floppy disk and only in DOS; other media and Oses are > not > > supported. VMWare also is not supported. (That tool is called Anadisk; > you > > can find a trial version here, fyi: > > http://retro.icequake.net/dob/files/bleuge/anadisk.207/). > > > > The tool "Winhex" already has a simple feature (Edit > Modify Data > > > Invert/XOR/RightShiftby1/LeftShiftby1) but for various reasons I cannot > use > > it. > > > > Any suggestions are appreciated. > > > > Eric Van Buskirk > > Assistant City Prosecutor/CISSP > > City of Phoenix > > > > --------------------------------------------------- > > PLUG-discuss mailing list - [...] -- > powerofprimes@gmail.com > Carlos Macedo Gomes > _sic itur ad astra_ > --------------------------------------------------- > PLUG-discuss mailing list - [...] > The above answer from "Carlos Macedo Gomes" may put you on track. "However", if you still need some help, even after that, there is a guy in town here (at least he used to be) named Grey Staples, who has written and spoken on this topic, or a similar one, and has probably done this kind of work. See "http://www.zoominfo.com/people/Staples_Grey_124400481.aspx". (Once he spoke on a topic that seems sorta related to this, before the Phoenix Chapter ACM [see www.acm.org], and I think he even gave out free samples [paper copies] of the magazine article mentioned on the web at the above listed URL. The article gave more details than could reasonably have been fit in to a 1 to 2 hour presentation). I think his co. is called "Camelback Systems". (see "http://www.greystaples.com/"); In fact, at "http://www.greystaples.com/article.htm" there is a copy of that magazine article, mentioned above. However, I seem to remember that the paper re-prints included pictures or diagrams, which I thought were very helpful. The plain text (modified/updated though it may be), might seem kinda dry without the pictures or diagrams. -- Mike Schwartz Glendale AZ schwartz@acm.org Mike.L.Schwartz@gmail.com